Executive brief
The Linux kernel contains a use-after-free vulnerability in its BPF (Berkeley Packet Filter) TCP iterator function. When multiple threads interact with TCP connection tracking while a network monitoring tool reads TCP socket information, a race condition causes the kernel to access memory that has been freed, potentially allowing an attacker with local access to crash the system or execute arbitrary code.
Technical details
The vulnerability is a use-after-free in bpf_iter_tcp_established_batch() caused by a race condition in reference counting of TCP request sockets. The root cause is that reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock to the hash table with refcount 0, then drops the bucket lock before setting refcount to 3. The iterator function calls sock_hold() under lock assuming refcount > 0, but this assumption does not hold for request sockets. This causes sock_hold() to increment a refcount of 0, and when the publishing CPU's subsequent refcount_set() executes, it clobbers the iterator's reference, leaving the socket one reference short. The attack vector is local network access via TCP connections combined with reading BPF iterator output. The fix uses refcount_inc_not_zero() instead of sock_hold() and skips sockets that cannot be safely incremented, ensuring atomic and safe reference acquisition.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-22: disclosed